[postfixadmin/postfixadmin] f29ac1: 4.x: harden password recovery requests (#1136)

[Rodrigo C. C. <no...@gi...>]

  Branch: refs/heads/postfixadmin_4.0
  Home:   https://github.com/postfixadmin/postfixadmin
  Commit: f29ac152fb002d0a074bab0e1c1dbdc29f404fa9
      https://github.com/postfixadmin/postfixadmin/commit/f29ac152fb002d0a074bab0e1c1dbdc29f404fa9
  Author: Rodrigo Cortés Cano <384...@us...>
  Date:   2026-09-02 (Wed, 02 Sep 2026)

  Changed paths:
    M functions.inc.php
    M model/Login.php
    M public/users/password-recover.php
    M tests/GetSiteUrlTest.php
    M tests/LoginTest.php
    A tests/PasswordRecoveryResponseTest.php

  Log Message:
  -----------
  4.x: harden password recovery requests (#1136)

Require a validated canonical site_url for recovery links, keep responses uniform, and persist a five-minute per-account request limit.

This ports the behavior of PR #1130 while preserving PHP 7.4 compatibility and the 4.x database boolean handling.

Refs #1128

Thanks @TrapoSAMA



To unsubscribe from these emails, change your notification settings at https://github.com/postfixadmin/postfixadmin/settings/notifications